CVE-2026-62948 Details
Description
OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40_dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5.
A stored cross-site scripting vulnerability has been identified in OpenWrt's web interface, LuCI, specifically in the Active DHCPv6 Leases admin page. This issue arises from the odhcpd DHCPv6 client handling, which, prior to version 25.12.5, wrote unescaped hostnames into the lease state file. The injection occurs when a DHCPv6 client sends a crafted hostname, embedding newline characters that forge additional lease records. These forged records are then displayed in the LuCI interface without proper HTML escaping, allowing the injected script to execute as live HTML. The vulnerability affects OpenWrt versions prior to 25.12.5, with the issue residing in the odhcpd component's lease file handling.
Users can upgrade to OpenWrt version 25.12.5, which addresses this vulnerability by escaping client-supplied hostnames before writing them to the lease state file.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535f | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/openwrt/luci/commit/55379d04fcc3c605003a5001d6135cf02ae6048a | [email protected] | Patch |
| https://github.com/openwrt/odhcpd/commit/68f382690bfaec56d5b1f31c3c31c48bcb642e3a | [email protected] | Patch |
| https://github.com/openwrt/odhcpd/pull/404 | [email protected] | Issue TrackingPatch |
| https://github.com/openwrt/openwrt/releases/tag/v25.12.5 | [email protected] | Release Notes |
| https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535f | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-117 | Improper Output Neutralization for Logs | [email protected] |
| CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openwrt openwrt | < 25.12.5 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | Initial Analysis | [email protected] |
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |